Vendor data breach: the Health P.E.I. case and a scorecard to rate your own vendors
On September 28, 2026, Health P.E.I. announced that one of its service providers, Maximus Canada, had been hit by a cybersecurity incident. An “unauthorized person” obtained a copy of a file created in 2011 containing health card information. Up to about 234,000 people could be affected, according to interim CEO Laurae Kloschinsky (CBC News).
For an SMB the lesson is twofold: your data also lives at your vendors, and an old, forgotten file is still a risk. Below is a scorecard to rate your own vendors in 10 minutes.
What we know (sources: Health P.E.I., CBC News)
- Where: at the vendor, Maximus Canada. Health P.E.I. says its own internal systems are protected.
- Who: people who had a P.E.I. health card number in or before 2011, and non-residents who received health services on the Island between 2008 and 2011.
- What: some or all of first name, last name, date of birth, date of death (where applicable), gender, P.E.I. personal health number and Medicare eligibility information.
- Risk: considered low by Health P.E.I., since health card information is not generally key identification.
Why this matters to your SMB
A 15-year-old file at a third party was enough. In an SMB, the equivalent almost always exists: an old customer export at the payroll software vendor, an old website with forms, a folder shared with the accountant. After a breach, that data is often used to make phishing more convincing.
In Quebec, Law 25 notably requires that personal information entrusted to a service provider be covered by a written contract specifying protection measures, that personal information be destroyed or anonymized once its purpose has been achieved, and that a confidentiality incident presenting a risk of serious injury be reported to the Commission d’accès à l’information and to the people concerned. This is not legal advice.
Scorecard: rate your vendors (out of 16)
For each vendor that holds data about your clients or employees, give 0, 1 or 2 points per criterion.
| Criterion | 0 points | 1 point | 2 points |
|---|---|---|---|
| 1. Inventory | We don’t know what data they hold. | General idea. | Written list of the data and where it is. |
| 2. Minimization | We send everything “just in case.” | Some fields removed. | Only what they need. |
| 3. Retention | No rule; everything is kept. | Written rule, never checked. | Destruction or anonymization checked every year. |
| 4. Written contract | Online terms accepted, never read. | Contract with no security clause. | Protection measures, limited use and destruction specified. |
| 5. Incident notice | Nothing planned. | “Within a reasonable time.” | Notice without delay, with a named contact on each side. |
| 6. Access to your systems | Shared account, no MFA. | Named accounts, partial MFA. | Named accounts, MFA everywhere, access removed when the contract ends. |
| 7. Subcontractors and location | We don’t know where the data goes. | Country known, subcontractors unknown. | Location and subcontractors documented. |
| 8. Exit | Nothing planned for the end of the contract. | Data return promised verbally. | Return and destruction confirmed in writing. |
0 to 7: fix this month
Start with inventory, retention and the contract.
8 to 12: decent baseline
Add incident notice and an exit clause at the next renewal.
13 to 16: solid
Review the scorecard once a year.
Three things to do this week
- Find your “2011 files”: old exports, backups, shared mailboxes. What is no longer needed gets destroyed (respecting legal retention periods, such as for tax records).
- Ask your top 3 vendors who your contact would be in an incident, and how fast they would notify you.
- Prepare your team: after a third-party breach, be wary of emails quoting real details to build trust. See our 5 signs an SMB is an easy target.
How NeoTech can help
We help SMBs in Laval, Montréal and the North Shore map where their data lives, close unnecessary vendor access and roll out MFA everywhere. Our automated 24/7 monitoring with an on-call technician response flags unusual sign-ins, including from a vendor account. See also our cybersecurity services.
Book your free cyber check
Want to know which vendors still have access to your systems, and what old data is lying around? In a short meeting, we take stock and prioritize.
Call us at 438-476-2322 or email info@neotechcloudsolutions.com.
Sources
- CBC News — 234,000 people may be affected in personal information breach, says Health P.E.I. (September 28, 2026)
- Government of P.E.I. — Health PEI notifies the public of a privacy incident
- CTV News — Health PEI says unauthorized person accessed file from 2011
- Commission d’accès à l’information du Québec (Law 25) — general framework; not legal advice
Photo: Element5 Digital (Pexels).